Request For 3 blocks : Free 0 : Used 1 Current Index 1 1 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 1 1 1 1 1 1 1 1 1 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 1 1 1 1 0 0 0 0 0 0 0 1 0 1 0 1 1 1 1 1 1 1 1 0 0 0 1 1 0 0 0 0 0 0 0 0 nt!RtlFindClearBitsAndSet
If all searches failed : Free 0 : Used 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Kernel VA dynamic allocate will taken (32bit) : Free 0 MiObtainSystemVa is used to dynamically allocate VA range : Used 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Interesting picking sequence An empty page: 0x1000
Interesting picking sequence 1 st allocation picked from front: 0x1000 0x808 0x7F8
Interesting picking sequence 2 nd allocation picked from end: 0x1000 0x808 0x7F8 0x808 0x200 0x5F8
Our controlled way (small) ExallocatePoolWithTag Size? Small Pool Medium Lookaside Pool Searching Large Pool Evaluation FreeList Searching N Success? expand the pool using MiAllocatePoolPages Success? N Y and split Y Y Return
Our controlled way (small) ExallocatePoolWithTag Size? Small Pool Medium Lookaside Pool Searching Large Pool Evaluation FreeList Searching N Success? expand the pool using MiAllocatePoolPages Success? N Y and split Y Y Return
Our controlled way (small) ExallocatePoolWithTag Size? Small Pool Medium Lookaside Pool Searching Large Pool Evaluation FreeList Searching N Success? expand the pool using MiAllocatePoolPages Success? N Y and split Y Y Return
Our controlled way (small) ExallocatePoolWithTag Size? Small Pool Medium Lookaside RtlpFindEntry(); Pool Searching RtlpHeapRemoveListEntry(); // FreeListEntry is controlled Large Pool Evaluation FreeList if (CommitSize < FreeListEntry ->Size){ Searching N Success? // Force the CommitSize smaller than // the FreeListEntry ‐>Size RtlpCreateSplitBlock(); } Success? return Chunk Y Y Return
Our controlled way (small) ExallocatePoolWithTag Size? Small Pool Medium Lookaside Pool Searching Large Pool Evaluation FreeList Searching N Success? expand the pool using MiAllocatePoolPages Success? N Y and split Y Split Chunks Y Return
Or this way (Medium) ExallocatePoolWithTag Size? Small Pool Medium Lookaside Pool Searching Large Pool Evaluation FreeList Searching N Success? expand the pool using MiAllocatePoolPages Success? N Y and split Y Split Chunks Y Return
What about size > 0xFF0? Daniel: Yes it will. There's always a way out... -Quotes from Stargate SG-1 "Abyss" A: if ( size_t < 0x400 ) B: if (( size_t >= 0x400 ) & ( size_t < 0x800 )) C: if (( size_t >= 0x800 ) & ( size_t < 0xFF0 )) D: if ( size_t >= 0xFF0)
A: if ( size_t < 0x400 ) Make holes on size 0x1000 chopping board 0x1000 0x808 0x538 0x200 0xC0
B: if (( size_t < 0x400 ) & ( size_t < 0x800 )) Make holes on size 0x2000 chopping board 0x1000 0x1000 0x1010 0x538 0x9F8 0xC0
C: if (( size_t > 0x800 ) & ( size_t < 0xFF0 )) Make holes on size 0x3000 chopping board 0x1000 0x1000 0x1000 0x1020 0xFE0 X 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0
D: if ( size_t > 0xFF0) Vulnerable buf will be allocated by MiAllocatePoolPages directly 0x1000 0x1000 0x1010 0xF30 0xC0
Demo of this section
2.01: Windows Objects in Kernel Vulnerability Exploitation
Exploitation in Windows 7 (Bonus) kd> dt nt!_OBJECT_HEADER • +0x000 PointerCount : Int4B +0x004 HandleCount : Int4B +0x004 NextToFree : Ptr32 Void +0x008 Lock : _EX_PUSH_LOCK +0x00c TypeIndex : Uchar // used to be a Ptr in XP +0x00d TraceFlags : UChar +0x00e InfoMask : UChar +0x00f Flags : UChar +0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION +0x010 QuotaBlockCharged : Ptr32 Void +0x014 SecurityDescriptor : Ptr32 Void +0x018 Body : _QUAD
Exploitation in Windows 7 (Bonus) 0x01: InitTrampoline: Mapping VA 0x0 through NtAllocateVirtualMemory 0x02: Modify TypeIndex Then..
0x03: Jump into shellcode when CloseHandle() mov ebx, _ObTypeIndexTable[ecx*4] // ecx is TypeIndex … call dword ptr [ebx+74h]
Exploitation in Windows 8 (Mateusz ‘j00ru’ Jurczyk way) • kd> dt nt!_KTIMER 84247538 +0x000 Header : _DISPATCHER_HEADER +0x010 DueTime : _ULARGE_INTEGER 0x4`9b8e6360 +0x018 TimerListEntry : _LIST_ENTRY [ 0x85360160 - 0x82765ce4 ] +0x020 Dpc : 0x84247590 _KDPC +0x024 Period : 0x7d0
Exploitation in Windows 8 (Mateusz ‘j00ru’ Jurczyk way) • kd> dt nt!_KDPC +0x000 Type : UChar +0x001 Importance : UChar +0x002 Number : Uint2B +0x004 DpcListEntry : _LIST_ENTRY +0x00c DeferredRoutine : Ptr32 void +0x010 DeferredContext : Ptr32 Void +0x014 SystemArgument1 : Ptr32 Void +0x018 SystemArgument2 : Ptr32 Void +0x01c DpcData : Ptr32 Void
2.02: Practical exploiting kernel pool Overflow / Corruption
Exploiting Kernel Pool Overflow / Corruption Important data Vulnerable buffer structure Overflow into App-Specific data ^ ^ Pool Header As we know the sizes of current trunk and previous trunk, we could build a fake header without modify origin one.
2.03: Practical Exploiting write-what-where vulnerability
Place object at a predictable address 0x9e51e000 (a relative high address, supposed be reached only through heap spray) 0x1000
Place object at a predictable address 0x9e51e000 0x1000 0x900 0x700 0x9e51e900
Place object at a predictable address 0x9e51e000 0x1000 0x900 0x700 0x900 0x6B8 0x48 0x9e51e900 + 0x1c: TypeIndex
Demo
0x03: Implementation in User Heap
Allocation Algorithm pre‐view HeapAlloc( x, x, size) Size? size < 0x4000 FrontEnd 0x4000 – 0x7FFFF ( LFH) size > 0x7FFFF Evaluation Backend N Activated? Success? VirtualAlloc N Y Y Y Return
3.01: Practical Attacking _HEAP_USERDATA_HEADER
_HEAP_USERDATA_HEADER • Idea brought by Chris Valasek • Chunk = UserBlocks + RandIndex * BlockStride + FirstAllocationOffset
Two Challenges • 18 times of allocations will trigger LFH • 400 times of allocations will trigger guard pages.
LFH GP LFH & Guard Pages Vul buffer Vul buf _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY GP – PAGE_NOACCESS _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY GP – PAGE_NOACCESS _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY
The target _HEAP_USERDATA_HEADER Overflow direction Vulnerable buffer eg: 0x300 UserBlocks for _HEAP_BUCKET[eg: 0x200] to position the vulnerable buffer just BEFORE an important structure. Like: _HEAP_USERDATA_HEADER structure
Mandatory Search in Action • Defragment using chunk 0x4000 - 0x7FFFF. • Freeing (0x70100) --> Allocating (0x70000) Could make 0x100 hole. Hey, get out of my way -- LFH • The size of UserBlocks (total size) is fixed.
Noise Taken 0x01: Defragment Free 0x8000 0x8000 0x8000 0x8000 0x8000
Noise Taken 0x02: Freeing Free 0x8000 0x8000 0x8000 0x8000 0x8000
0x03: Alloc 0x6000 block Noise Taken and make 0x2000 hole Free 0x8000 0x8000 0x8000 0x6000 0x2000 0x8000
Noise Taken 0x04: Trigger LFH (0x200) Free 0x8000 0x8000 0x8000 0x6000 0x2000 0x8000 UserBlocks for _HEAP_BUCKET[0x200]
LFH Taken Take a closer look at Free 0x6000 _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY UserBlocks for _HEAP_BUCKET[0x200]
LFH Taken Free 0x6000 block Free 0x6000 _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY
Alloc 0x5D00 block Taken and make 0x300 hole Free 0x6000 – 0x300 0x300 _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY
Taken Vul buffer Alloc vulnerable buffer Free 0x6000 – 0x300 0x300 _HEAP_USERDATA_HEADER _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY _HEAP_ENTRY
Future allocation will get controlled Vul buffer after overflow Controlled 0x8000 0x8000 0x8000 UserBlocks 0x8000 Future allocation s will fall into this controlled area.
Applicable circumstance (Prerequisites) - The LFH of the certain bin size has not been activated by the time of allocation. ( no 16 consecutive allocations of the vulnerable buffer’s size) - Allocate Buffer of Arbitrary Size w/ Arbitrary Content - Free Buffer of Arbitrary Size - Programmatic Control of Allocations and Frees
The exploitation process: Step 0: Figure out the vulnerability Step 1: Heap Feng Shui. Step 2: Trigger the overflow, modify "FirstAllocationOffset” Step 3: Allocate new objects with proper size. Step 4: Modify new object’s content. Step 5: Control the EIP.
3.02: Practical Heap Determining in IE 10
Recommend
More recommend
